Avoids shell-quoting hell. Used as:
docker compose ... exec -T api \
python -m app.cli.reset_password admin@example.com NEW_PASSWORD
docker compose ... exec -T api \
python -m app.cli.reset_password --list
Lists existing users on lookup miss so it's obvious which email to
target. Refuses passwords shorter than 4 chars to catch typos.